Privacy policy
Last updated: 2 November 2026
Who this covers
This policy covers visitors to this website, people who contact us through the form, and users of the Imagora service. When a business uses Imagora to market to its own customers, that business decides what happens to its customers' data and Imagora acts on its instructions as a processor.
This website
Before you choose anything in the cookie banner, the site sends us an anonymous page view, with no identifier. If you accept, your browser receives a first-party visitor id, and click identifiers and campaign parameters from the address are kept for 90 days. If you refuse, only anonymous events are counted. We record your choice, the time and the version of the text.
The contact form sends us your name, business, email, optional phone and message. We use them to answer you, on the basis of the steps you ask for before a contract. News by email is sent only if you tick the box, and only after you confirm it from your inbox.
The service
For a business using Imagora we process its account and users; what it sends as knowledge (products, prices, photos, opening hours, reviews, aggregated sales); leads with their source and consent; customers with proven marketing consent, plus a summary of their history; campaign and advertising data; and a log of actions.
A customer without proven marketing consent is not stored, only counted. We keep no individual orders, only a summary per customer. For medical businesses, no patient data enters the service, and events sent to ad networks carry no specialty, service or diagnosis.
Who else receives data
Infrastructure: Fly.io (application), Supabase (database), Cloudflare (files and pages), Upstash or Fly.io (queues), Sentry (error reports). Messages: Resend (email), BulkGate (SMS, Viber, WhatsApp). AI: Anthropic, Google Vertex and OpenAI, for text, checks and images; only the business's facts and content are sent, not its customer list. Payments: Stripe.
Meta, Google and TikTok receive data only after consent, with email and phone hashed, and only if the business has connected them.
How long
Marketing data is kept for 24 months and then deleted. Click identifiers are kept for 90 days. A request to erase a contact is honoured across the service, and the contact is placed on a suppression list so that they are not added again.
Your rights
You can ask for access, correction, erasure, restriction or portability, object to processing, and withdraw consent at any time, without affecting what was done before. Every marketing message has a one-click unsubscribe. Write to us through the contact form. You may also complain to your national data protection authority. If you are the customer of a business that uses Imagora, you may address that business directly.
Security
Each business's data is separated at database level, secrets are encrypted, and access is logged.